DAY 6

Focusing on building openssl.

Instantiate a fresh CentOS 6.4 server and then...

Code:

yum -y update # Update everything
yum -y groupinstall 'Development tools'
yum -y install zlib-devel
yum -y install krb5-devel

cat /etc/centos-release
# CentOS release 6.4 (Final)

uname -rpo
# 2.6.32-279.el6.x86_64 x86_64 GNU/Linux

gcc --version
# gcc 4.4.7 20120313 (Red Hat 4.4.7-3)

We now have all the tools to rebuild openssl. We are going to build as user "abcd".

Code:

userdel -rf abcd ; useradd abcd ; su abcd # Wipe user abcd, create fresh user abcd, become user abcd
echo "%_topdir /home/$USER/rpmbuild" > ~/.rpmmacros ; # Tell rpm where to install files
echo "%packager Test User " >> ~/.rpmmacros # Tell rpm a test user id
echo "%_query_all_fmt %%{name}-%%{version}-%%{release}.%%{arch}" >> ~/.rpmmacros # Tell rpm the architecture
cd ~ ; curl -O http://vault.centos.org/6.4/os/Source/SPackages/openssl-1.0.0-27.el6.src.rpm # Get openssl source
rpm --install openssl-1.0.0-27.el6.src.rpm 1>e1 2>e2 # Extract the source package to /rpmbuild/SOURCES
cd ~/rpmbuild/SPECS # This is where the package .spec file is extracted to
sed -i -e "s/no-ec/enable-ec/; s/no-ecdh/ /; s/no-ecdsa/ /" ~/rpmbuild/SPECS/openssl.spec
sed -i -e "s/^Source1: hobble-openssl/#&/; s/^%.SOURCE1. /#&/" ~/rpmbuild/SPECS/openssl.spec # Edit the .spec file
rpmbuild -bb openssl.spec 1>e1 2>e2 & # Rebuild the package using the edited .spec file

# The above rebuild of openssl-1.0.0j takes a long time - at least 20 minutes.

jobs # Command to check if the compile is done
# [1]+ Running rpmbuild -bb openssl.spec > e1 2> e2 &

tail -f e2 # or "tail -f e1" (ctl-c to exit) command to check the build progress

# When the build finishes, the compiler output is in files e1 and e2 in ~/rpmbuild/SPECS

less -i e2 # Command to let you browse the build errors. Search for "error" with /error

# ====================================================================
# =========================== After the build ========================
# ====================================================================

Note: openssl-1.0.0-27.el6.src.rpm compiles 100% correct AS DOWNLOADED - evidence that the build environment is OK.

However, we make the following five changes (see the sed lines above) to enable elliptic curves:

s/no-ec/enable-ec/
s/no-ecdh/ /
s/no-ecdsa/ /
s/^Source1: hobble-openssl/#&/
s/^%.SOURCE1. /#&/

When the package is built with these five changes in, there are build errors.

THIS IS WHERE I NEED YOUR HELP.

Build errors here, near the end of the file: http://pastebin.com/8aGxEd6n

I find them extremely hard to resolve due to my inexperience.

p_lib.c:318: error: expected declaration specifiers or '...' before 'EC_KEY'

Looking at the preprocessor output with gcc -E, I saw that EC_KEY is undefined.

I found this handy: http://fossies.org/dox/openssl-1.0.1e/index.html

EC_KEY is defined in /crypto/include/ec.h

If I manually edit p_lib.c to include ec.h, this error vanishes.

So, for some reason, ec.h is not included in p_lib.c. I wonder why and how to properly fix it.

Comments and suggestions welcome.

neonzeon

Posts

Merits